Submission Details
Severity:
Contribution amount not updated in `contribute` function
Summary
The contribute function transfers SOL but doesn't update the contribution amount.
Vulnerability Details
pub fn contribute(ctx: Context<FundContribute>, amount: u64) -> Result<()> {
// Transfer SOL from contributor to fund account
let cpi_context = CpiContext::new(
ctx.accounts.system_program.to_account_info(),
system_program::Transfer {
from: ctx.accounts.contributor.to_account_info(),
to: fund.to_account_info(),
},
);
system_program::transfer(cpi_context, amount)?;
fund.amount_raised += amount;
//@audit Missing: contribution.amount += amount;
Ok(())
}
Impact
Loss of contribution tracking
The
contribution.amountremains at 0.
Tools Used
Recommendations
fund.amount_raised += amount;
contribution.amount += amount;
Ok(())
Updates
Appeal created
bube 6 months ago
Submission Judgement Published Assigned finding tags:
Contribution amount is not updated
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.